IN THE CLAIMS 

Please amend the claims to read as follows : 
Listing of Claims 

1 . (Currently Amended) A network monitoring system for 
monitoring a communication state on a network in which action 
explanation information for explaining a single action is divided 
into a plurality of packets, the network monitoring system 
comprising: 

a data acquisition section f o r ac q uirin g th e that acquires a 
plurality of packets flown on the network; 

a data analysis section f o r acquirin g th e that acquires 
action explanation information from the plurality of packets 
acquired by the data acquisition section; and 

a display-information generation section f o r g en e ratin g 
dis p lay that generates information , which is us e d t o dis p lay the 
sin g l e of each individual action occurring on the network on a 
sin g le s c r ee n on the basis of the action explanation information 
acquired by the data analysis section ; and 

a display unit that displays the information generated by 
the display-information generation section, wherein: 

in response to a request by a user, the display-information 
generation section regenerates, for continuous play back. 



information of a sequence of individual actions that occurred on 
the network and cooperates with the display unit to display, 
during each play back, the regenerated information of each 
individual action of the sequence at the same time interval 
within the sequence as the action occurred . 

2. (Original) The network monitoring system according to 
claim 1 , wherein the action explanation information is defined in 
advance . 

3. (Original) The network monitoring system according to 
claim 1, wherein the data analysis section identifies kinds of 
the packets acquired by the data acquisition section and acquires 
the action explanation information from the packets on the basis 
of the identified kinds of the packets. 

4. (Original) The network monitoring system according to 
claim 1, wherein the action explanation information includes 
sending source computer information, destination computer 
information, and action information. 

5. (Currently Amended) The network monitoring system 
according to claim 1, further comprising: 
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an analysis data storage section f o r st o rin g that stores the 
action explanation information acquired by the data analysis 
section , wherein : 

the display-information generation section regenerates the 
information of the sequence of individual actions that occurred 
on the network from display information us e d t o p layba c k and 
dis p lay the action explanation information stored by the analysis 
data storage section in r e s po ns e t o a r eq u e st o f a us e r . 

6. (Currently Amended) The network monitoring system 
according to claim 5, wherein: 

the action explanation information stored by the analysis 
data storage section includes time information, which corresponds 
to the time at which the single action occurred was p e rformed ; 
and 

the display-information generation section determines the 
time interval, within the sequence, that each individual action 
occurred using r eg enerat e s th e dis p lay informati o n us e d t o 
p layback and display th e action e x p lanati o n informati o n st o r e d by 
th e analysis data st or a ge s e cti o n in acc o rdanc e w ith the time 
information^ — in r e sp o nse t o a r eq u e st o f a us e r stored by the 
analysis data storage section . 
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7. (Currently Amended) The network monitoring system 
according to claim 5, wherein the display-information generation 
section continuously regenerates the sequence after each 
predetermined period, which period is accurate within 500 
milliseconds continu o usly plays back and dis p lays th e acti o n 
ex p lanati o n informati o n st o r e d by th e analysis data st o ra ge 
s e cti o n at th e same tim e int er val t o an accuracy o f 500 ms e c as 
th e acti o n w as e x e cut e d, — in r e spons e t o a r eq u e st o f a us e r . 

8 . (Currently Amended) The network monitoring system 
according to claim 1, wherein the display-information generation 
section extracts and generates the dis p lay information of each 
action occurring on the network in accordance with a display 
setting set by a user. 

9. (Currently Amended) A network monitoring method for 
monitoring a communication state on a network in which action 
explanation information for explaining a single action is divided 
into a plurality of packets, the method comprising: 

acquiring -the a plurality of packets flown on the network; 
acquiring the action explanation information from the 
plurality of acquired packets; and 
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generating dis p lay information , w hich is us e d t o display th e 
sin g l e action o n th e n e t wo rk o n a sin g l e scr ee n of each 
individual action occurring on the network on the basis of the 
acquired action explanation information^ 

regenerating for continuous play back, in response to a 
request by a user, information of a sequence of individual 
actions that occurred on the network; and 

displaying on a display unit, during each play back, the 
regenerated information of each individual action of the sequence 
at the same time interval within the sequence as the action 
occurred. 

10. (Original) The network monitoring method according to 
claim 9, wherein the action explanation information is defined in 
advance . 

11. (Original) The network monitoring method according to 
claim 9, wherein in the acquisition of the action explanation 
information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information 
is acquired from the packets on the basis of the identified kinds 
of the packets . 
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12. (Original) The network monitoring method according to 
claim 9, wherein the action explanation information includes 
sending source computer information, destination computer 
information, and action information. 

13. (Currently Amended) The network monitoring method 
according to claim 9, further comprising: 

storing the acquired action explanation inf ormation, 
wherein : 

in th e ge nerati o n o f th e dis p lay informati o n, the dis p lay 
information of the sequence of individual actions that occurred 
on the network is regenerated- — the r ege n e rated dis p lay 
information us e d t o p lay back and dis p lay from the stored action 
explanation information in r e sp o ns e t o a r eq uest o f a us e r . 

14 . (Currently Amended) The network monitoring method 
according to claim 13, wherein: 

the stored action explanation information includes time 
information, which corresponds to the time at which the single 
action occurred w as p erf o rmed ; and 

in th e ge n e rati o n o f th e display information, — th e dis p lay 
informati o n is r ege n e rat e d, — th e re ge n e rat e d display information 
us e d t o p lay back and display th e st o red acti o n e xplanation 
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information in acc o rdanc e with the time interval, within the 
sequence, that each individual action occurred is determined 
using the stored time information in resp o ns e t o a r eq u e st o f a 
user . 

15. (Currently Amended) The network monitoring method 
according to claim 13, further comprising continuously 
regenerating the sequence after each predetermined period, which 
period is accurate within 500 milliseconds p layin g back and 
dis p layin g th e stor e d acti o n e x p lanati o n information at the same 
tim e int e rval t o an accuracy of 500 ms ec as th e acti o n was 
e x e cuted in r e sp o ns e t o a re qu e st o f a us e r . 

16. (Currently Amended) The network monitoring method 
according to claim 9, wherein in th e ge nerati o n o f th e display 
inf o rmati o n , the display information of each action occurring on 
the network is extracted and generated in accordance with a 
display setting set by a user. 

17. (Currently Amended) A network monitoring program 
recorded on a computer readable medium and executable by a 
computer for the purpose of monitoring a communication state on a 
network in which action explanation information for explaining a 
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single action is divided into a plurality of packets, the program 
making a the computer perform a process comprising: 

acquiring the a plurality of packets flown on the network; 

acquiring -the action explanation information from the 
plurality of acquired packets; and 

generating display information , w hich is us e d t o display th e 
sin g l e action o n th e n e t w ork o n a sin g l e scr ee n of each 
individual action occurring on the network on the basis of the 
acquired action explanation information^ 

regenerating for continuous play back, in response to a 
request by a user, information of a sequence of individual 
actions that occurred on the network; and 

displaying on a display unit, during each play back, the 
regenerated information of each individual action of the sequence 
at the same time interval within the sequence as the action 
occurred. 

18. (Original) The network monitoring program according to 
claim 17, wherein the action explanation information is defined 
in advance. 

19. (Original) The network monitoring program according to 
claim 17, wherein in the acquisition of the action explanation 



information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information 
is acquired from the packets on the basis of the identified kinds 
of the packets . 

20. (Original) The network monitoring program according to 
claim 17, wherein the action explanation information includes 
sending source computer information, destination computer 
information, and action information. 

21. (Currently Amended) The network monitoring program 
according to claim 17, wherein: 

the process further comprises storing the acquired action 
explanation information; and 

in th e ge n e rati o n o f th e dis p lay inf o rmati o n, the dis p lay 
information of the sequence of individual actions that occurred 
on the network is regenerated^ — th e re ge n e rat e d dis p lay 
informati o n us e d t o p lay back and display from the stored action 
explanation information in r e s po nse t o a r eq u e st o f a us e r . 

22 . (Currently Amended) The network monitoring program 
according to claim 21, wherein: 
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the stored action explanation information includes time 
information, which corresponds to the time at which the single 
action occurred was pe rformed ; and 

in the g e n e rati o n o f th e dis p lay informati o n, — th e display 
informati o n is re ge n e rat e d, — th e r ege n e rat e d display information 
us e d t o p lay back and display th e st o r e d acti o n e x p lanati o n 
informati o n in acc o rdanc e w ith the time interval, within the 
sequence, that each individual action occurred is determined 
using the stored time information in r e sp o ns e t o a r eq u e st o f a 
user . 

23. (Currently Amended) The network monitoring program 
according to claim 21, wherein the process further comprises-r 
continuously regenerating the sequence after each predetermined 
period, which period is accurate within 500 milliseconds p layin g 
back and dis p layin g th e st o r e d acti o n e x p lanati o n inf o rmation at 
th e sam e tim e int e rval t o an accura c y o f 500 ms e c as th e acti o n 
was e x e cut e d in r e sp o ns e to a r eq u e st o f a us e r . 

24. (Currently Amended) The network monitoring program 
according to claim 17, wherein in th e ge n e rati o n o f th e dis p lay 
information , the dis p lay information of each action occurring on 
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the network is extracted and generated in accordance with 
display setting set by a user. 



12 



